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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/15/2005 

To: Investigative Technology Division Attn: Evidence Control 

CART - I 


From: 


St Louis 

Squad 3/CftRT/Room 243 
Contact: 


Approved By: 

Drafted By: 

Case ID #: 288A-SL-190190 
Title 


dim 




(Pending) 


St. Louis Post-Dispatch - victim; 
Computer Intrusion 


Synopsis: Request a CART examination of a Hard Disk Drive (HDD) 

y-^Sptrxuned-teel-Qw-. 

ackage Copy: Being forwarded under separate covejpy i s o ne ( TL -feox 
containing the 'follp.w-i-ng^evd^ei 



Enclosure (s) : Enclos^for rTD/CAR^ 
Hfespzixd ngK J3AR ^-ex-amTna t^ i5rrT 


Reference: 288A-SL-190190 , serial 14. 

, t* 

Details: Request a CART examination be conducted on captioned HDD 
which was seized from Everyone's Internet company of Houston. The 
HDD opera ting system is Red Hat Linux, Enterprise Edition. SA 
request all logfiles containing logon/logoff dates, 
times , Snd identities. Also any discovered software tools that 
may be used for exploiting computer systems, with special 
attention to SQL injection exploits and any proxy software. 
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< , '((.Message 


|(SL) (FBI) 


From: 


](SL) (FBI) 


Sent: Thursday, March 10, 2005 4:24 PM 

I 


To: 


(ITD) (FBI) 


Subject: St. Louis, one EXPEDITE case & (1) ROUTINE, 


UNCLASSIFIED 

NON-RECORD 


Thanks for the timely phone call, I was able to stop the shipment of the (LINUX)HDDs & forward them to you. 

I greatly a ppreciate th e sup port! _ 

The EXPEDITE case is: 288A-SL-190144, two(2) HDDs, 200GB cap. 

The Routine case is: 288A-SL-190190, (1) HDD, 80GB cap. 

All documentation should be complete. 

Please give me a contact when you receive them. 

Thanks again: 

|SL-CART 


— Ori ginal Message — 

From; I l (ITD) (FBI) 

Sent: Tuesday, March 08, 2005 1:12 PM 
To: K SL) (FBI) 

Cc: I (ITD) (FBI) 

Subject: Unix Cases 

UNCLASSIFIED 

NON-RECORD 


Per our conversation, I understand that you have two (2) Unix cases that need Examinations. We will concentrate 
on the Expedite case for you and work the routine case as soon as another Examiner is freed up. 

Please send, the evidence for each seperately and include an EC requesting the examination for each along with 
a copy of the search warrant/Consent form. 

You can send the evidence to: 
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3 / 11/2005 



.^Message 
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ERF 

ERF Building 27958A 
Quantico, Va. 22135 

Attn: Forensic Program 

Let me know if you have any questions. 

Computer Analysis^ Response Team (CART) 


UNCLASSIFIED 


b6 
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UNCLASSIFIED 


3/11/2005 




r 


******************************************************************* 

FORENSIC MD5 Serial No.: 50383 Software: VI. 82 ***** 

******************************************************************* 


* Evidence Number 


Alias 


* Evidence Acquired by_ 

* 

* Evidence Acquired on_ 

* 

* Location, at scene 

* 

* Description 

* 


SESSION SETTINGS 


* Operating Mode 

* Verify 

* Connection 


WipeClean 

None 

Direct 


Address Mode : LBA 

Speed : UDMA-4 


******************************************************************* 


************************ 


************************* DESTINATION DRIVE ************************ 

************************************************************************ 


Physical Characteristics 


Drive Model: Maxtor 6Y160P0 
Serial: Y42Q4QQE 


Cylinders 

317632 


Heads 

16 


Sectors 

63 


Total Sectors 
320173056 


Drive Size 
152.7 GB 


************************************************************************ 

************************************************************************ 

************************************************************************ 


. cesfore_images.log 

The investigator's name: sa| 

The subject's name: post_diSPATCH 

A description of the subject's computer: Single 80 GB HDD, ser#33V03B5Y. 
System date: 

Mon Mar 7 07:59:16 EST 2005 

User entered date/time: 

Current date: 03/07/2005 
Current time: 07:59:16 


■ Final check 

The Evidentiary source: stO 

The Evidentiary Source Survey: stO 

The 1st Output Drive: /dev/hda, Drive: hda disk, 

model : Maxtor 6Y160P0 

1st Log File: /mnt/out/admin/restore_i mages. log 
Md5verify: Yes 

Compressed Src image(s) /Drive: No 
compress 

Output lmage(s)/Drive: No 

Restoring from tape images to device... in /mnt/out. 
Beginning: 3-07-2005 07:59:27 AM 


Restoring from 

tape images to device: in /mnt/out. 

dcfldd if=/dev/st0 conv=noerror , sync bs=1024 | tpipe "md5sum > /tmp/filekFLJ6x" 
dcfldd 

of=/dev/hda conv=noerror ,sync bs=1024 2> /tmp/record_writtenl 

Restoring from tape to device ended... in /mnt/out. 

Ending: 

3-07-2005 10:00:56 AM 


Calculating md5sum... in /mnt/out. 
Beginning: 3-07-2005 10:00:59 AM 


Executing md5sum command: in 
/mnt/out. 

dcfldd if=/dev/hda conv=noerror,sync bs=1024 count=78150744 2> /tmp/tape . 1 og | 

md5sum > /tmp/filekFL36x 
78150744+0 records in 
78150744+0 records out 

Calculating md5sum... in /mnt/out. 

Ending: 3-07-2005 10:37:58 AM 


Page 1 
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restore_i mages . 1 og 

2840616619429b0d91376dl079fe2 - src: /dev/stO, records written: 78150744, 

tape_count#: 1 

2840616619429b0d91376dl079fe2 - dest: /dev/hda, records written: 78150744, 

tape_count#: 1 
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(Address) 
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To Be Returned □ Yes 0^No 

Receipt Given □ Yes S^No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


□ Yes 

Federal Taxpayer Information (FTI) 

□ Yes 


R'No 

Qi*r 


<S7T £aurs / :? 0S7' - — X/id-TrsM. ; 


Reference: 



(Communication Unclosing Material) 




Description: "^0 ting in g ) notes( ^intcrviow -o) 6&L/d&S/cfsfi&7 ~ • 
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From: 

Sent: Wednesday, October 05, 2 005 1:44 PM 

To: 


J(OTD) (FBI) 

2005 1 
l(SL) (FBI) 


Subject: 288A-SL-190190 


UNCLASSIFIED 

NON-RECORD 

h CD 

Just a quick note to let you know that the case is completed. Evidence and DE will be shipped via fedex 
tomorrow, should arrive Friday. I put a note in the box for the ECT to contact you when it comes in. 

Report will be sent out to you via bumail tomorrow. It is uploaded, 302 serial is 23, transmittal ec serial is 24. 

Let me know if you have any questions. 

LL 

I I 

ITS/F E. CART. FBI HQ 
Work I 

Cell 


UNCLASSIFIED 


10/11/2005 






18-252 (7-1-2005) 

ERF Shipping Invoice 

FEDERAL BUREAU OF INVESTIGATION 
BLDG. 27958A 
QUANTICO, VA 22125 

Date: 10/^/2005 
To: FBI 

ATTN: Evidence Control 
2222 Market St. 

St. Louis, MO 63103 

ph: 314-589-2500 


Invoice of Contents: 

QHQl 

DEHQ1-DEHQ3 


Return to: 


Phone: 


Case 3D No. 288A-SL-190190 


b6 
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Contributor No. 

Lab No. 050309251 AB 


Title: ST. LOUIS POST-DISPATCH 
COMPUTER INTRUSION 


Shipping Number: 




FedEx | Ship Manager | Label 7924 0379 8969 


Page 1 of 1 


PecOss. 

Express 




SHIP TO: (314)589-2500 BILL SENDER 

EVIDENCE CONTROL TECHNICIAN 
FBI -ST. LOUIS 
2222 MARKET ST 


From: Origin ID: (703)632-6191 
Dale Linden 
FBi-ERF ANNEX 
BUILDING 27958-A 

QUANTICO.VA 22135 


Ship Date: 060CT05 
Actual Wgt: 5 LB 
System#: 3815024/INET2200 
Account#: S ********* 


REF: E38 BRENT 1 81 8E 



Delivery Address Bar Code 


ST. LOUIS, MO 631032516 



PRIORITY OVERNIGHT 

trk# 7924 0379 8969 ^ 


STL 


FRI 

Deliver By: 
070CT05 

A1 


63103 

DSR 


-MO-US 



NL CPSA 



Shipping Label: Your shipment is complete 

1 . Use the 'Print 1 feature from your browser to send this page to your laser or inkjet printer. 

2. Fold the printed page along the horizontal line. 

3. Place label in shipping pouch and affix it to your shipment so that the barcode portion of the label can be read and scanned. 

Warning: Use only the printed original label for shipping. Using a photocopy of this label for shipping purposes is fraudulent and could result 
in additional billing charges, along with the cancellation of your FedEx account number. 

Use of this system constitutes your agreement to the service conditions in the current FedEx Service Guide, available on fedex.com. FedEx will not be responsible for any 
claim in excess of $100 per package, whether the result of loss, damage, delay, non-delivery, misdelivery, or misinformation, unless you declare a higher value, pay an 
additional charge, document your actual loss and file a timely claim. Limitations found in the current FedEx Service Guide apply. Your right to recover from FedExjbr any 
loss, including intrinsic value of the package, loss of sales, income interest, profit, attorney’s fees, costs, and other forms of damage whether direct, incidental, 
consequential, or special is limited to the greater of $100 or the authorized declared value. Recovery cannot exceed actual documented loss. Maximum for items of 
extraordinary value is $500, e.g. jewelry, precious metals, negotiable instruments and other items listed in our Service Guide. Written claims must be filed within strict time 
limits, see current FedEx Service Guide. 


https://www.fedex.com/cgi-bin/ship_it/uiiity/3BfXz7AcWs3BiTz8IeUt6FcQs8CbXw8AhZs4FaRxlJfVu7Ab... 10/6/2005 


view Collected item 


Type a valid action code, then press Enter. 
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Action , > , 

Case ID : 288A-SL-190190 


Category. , , 
Acquired Date 
Acquired Time 
Acquired By , 
Acquired From 


Pre Direction 
Street Name . 


city 

State .... 
Receipt Given 


IB 2 



ORIGINAL EVIDENCE (E01979557) 


Postal Code , , : 


Post Direction. . : 


Country , . 


Command 1 1 ) i ■ i ■ i > ■ i > > > i ■ ■ ■ ■ > > > > > ■ > > > > ■ > > > > i > ■ ■ i ■ i > ■ ■ ■ ■ > ■ ■ ■ ■ ■ ■ > ■ ■ ■ ■ ■ ■ ■ ■ ■ *f 
Fl=Help,F3=Exit,F4=Prompt,Fll=NextPg,Fl2=Cancel,F21=Case 


06,014 


10/18/05 view Collected item 

11:22:14 

Type a valid action code, then press Enter, 
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Action . > . 288A-SL-190190 IB 2 

Description : DESLl - TAPE CARTRIDGE W/IMAGE OF HDD, SN: 31V03B5Y, 80 GB 


office : SL 

Type , , , , : C Barcode . . : E02131268 Special Handling, . : 

Forfeiture Potential : Drug Confined : Hazardous Material : 

Anticipated Disposition : Anticipated Date. , : 

Sealed By , . . : Drug/Val Type , : 

Witnessed By . . : Drug Weight , : 

weapon safe By . : Dollar value. : 

Storage Location ... : ECR ROW6 CAB3 Media . . : 
Classification Level , : SN Authority , : Duration . : 

Handling Caveat , . . : Grand Jury Material . : fti . : 


I ■ ^ i i ■ i i i i i i i I I I I I I I I I I I I I I ■ I I I I I l I I I I I I I I l ( « l I l l I i i i i i i *1* 


F2Kase 

4a0 


06,014 



CART Request Summary - 1A Material 


Request Status: Open Assigned to FE 

Submission ID: 

24980 

Request Priority: 

3 

Lead Examiner: 

FET/OJT Assigned: 


Submitting Agency: 

Agency Case Number: 

FBI 

Date Request Generated: 
Date Request Closed: 

01/18/2005 

Created By: 

Date Analysis Needed: 


Involved with CAIR Program: No 

Request Description: 

Conduct examination on seized hard drive and 
provide Iogfiles including logon/logoff dates and 


Associated Case Data 


Record ID: 20844 


UCFN: 288A-SL-190190 


Case Agent: 


Case Title: I ST LOUIS POST-DISPATCH ■ 
VICTIM; COMPUTER 
INTRUSION... 



Archives/Searches 



Search Location: 

Legal Authority: Search Warrant 

Legal Authority Description: 

Highest Classification: 

Evidence To Be Examined: One (1) hard drive. 
Suspect Charged: No 

Accessed Evidence: 

Privileged Information: 

Other Comments: 


StatID I Examiner I Date Completed DE 


N 


CAIR Entries 


CAIR D) | Created By | Date Created 


CART Request Summary - 1A Material (Printed on 09/20/2005) 


















CART Case Summary - 1 A Material 


UCFN: 288A-SL-190190 

Case Title: ST LOUIS POST-DISPATCH - VICTIM; COMPUTER INTRUSION 

Case Agent: 

Case Synopsis: Computer Intrusion into Post-Dispatch internal employee Intranet site. 
Record ID: 20844 

Date Case Created: 03/14/2005 
Date Last Modified: ; 03/14/2005 


ttttiiD 



24980 


Conduct examination on seized hard drive 
and provide logfiles including logon/logoff 
dates and times. Also indicate if any 
hacking tools are present.... 


/ 



CART Case Summary - 1 A Material (Printed on 09/20/2005) 
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Federal Rules of Criminal Procedure / 
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Reference: 
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File Number 


Field Office Acquiring Evidence 

Serial# of Originating Document _ 

Date Received 4^1 


7 $rKk~5L~ 

Evidence S TL= 



(Name of Contributor/Inteiviewee) 


(Address) 



To Be Returned d Yes EET^No 

Receipt Given EJ^Yes O No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 

Federal Rules of Criminal Procedure 

□ yes 0 No 

Federal Taxpayer Information (FTI) 

□ yes 0 No 


Reference: 


(Communication Enclosing Material) 


Description: □ Original notes re interview of 

j •r-W'^ k- - 

YXt\aui/) fvf t ll43wi-li.'/_. 





12/28/04 

09:59:48 

* 


£itle and Character of Case: 
• SAINT LOUIS POST DISPATCH 


FD-192 


ICMIPR01 
Page 1 


Date Property, Acquired: Source from whi ch Property Acquired: 
12/22/2004 


HOUSTON TX 


Anticipated Disposition: Acquired By: 


Case Agent : 


Description of Property: 



Date Entered 

IB 1 




1 SEAGATE BARRICUDA HARD DRIVE 80GB S/nQ 



- 

Barcode: E01979557 Location: ECR12 ' 

§HELF23 

BIND 

12/28/2004 


Case Number: 288A-SL-190190 
Owning Office: HOUSTON 


package copy 
file copy 
forfeiture copy 
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FD-26 (Rev. 7-20-94) 


DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
CONSENT TO SEARCH 

1. I have been asked by Special Agents of the Federal Bureau of Investigation to permit a complete 
search of: 

(Describe the person(s), place(s), or thing(s) to be searched.) 

S ‘v A £a-T~ < I T ^ HlO 

4- t^-rc Hi 0 

' X . 12.0 C=>& WO 


ST 


-2>crT4.Fr*v 


s I pj -3.T T s 1° uL> 


yJ 


b6 
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2. I have been advised of my right to refuse consent. 

3. I give this permission voluntarily. 

4. I authorize these agents to take any items which they determine may be related to their investigation. 


12 . 



Signature 


Witness 


* >■ 


Chain of Custody FD-192 


Case ID 


/ffi ffO Barcode . 


Accepted By: 
Printed Name 



Signatur e. . 


Reason: .. Collected Date/Time: 




I I'.oZ fit*. 


Accepted By: 
Printed Name: 



Signature ; 


Reason: 




Date/Time 


: /£ hjjpy. . 


Accepted By: 
Printed Name 


Signature i . f. ■ 




Accepted By: 
Printed Name: 


. . . . Signature : . 


Reason 


Accepted By: 
Printed Name: 


Date/Time ■ . 


Signature : 





Reason: .... . . . . rr. Date/Time 


. 2./3/^ 


Accepted By: 
Printed Name : . 



Signature] 


Reason : 


. Date/Time^-^^¥^/H'<^. 


Accepted By: 
Printed Name : 



Reason: 


^•e\/}e^ 


|. Signature:. .. 

Date/Time: . 4"/ 


Accepted By: 
Printed Name : 


Reason 


i Name : I I Signature : J — , I ' tf Y u . ■ I ■ ■ .1 

: . . Date/Tim^ . .*?7 !V P.^? . . . ^ . . .OAK - — 


Accepted By: 
Printed Name 


Printed NameL, I Signature! I 

Reason : .C/I&t. . .^ 4 ^ 4*4 .* Date/Tii^^^4^^^V^^^^^> 


Accepted By: 
Printed Name : 



Signatur 



Reason: . . . Date/Time: . .3//!^ 0$. . . .£>. . 


WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 


Printed Name : 


Signature : 


Date : 



Chain of Custody FD-192 


Case ID....: 


IB 


Barcode . : 


Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 

Reason: 

Accepted By: 
Reason: 


Signature 

l A D ate/Tim e 4-/ ia/w 

Signature 

Date/Time 

Signature 

Date/Time 

Signature 

: Date/Time 

Signature 

Date/Time 

Signature 

Date/Time 

Signature 

Date/Time 

Signature 

Date/Time 

Signature 

Date/Time 



WEAPONS CHECKED &. CLEARED BY FIREARMS INSTRUCTOR 


Name:. 


.Signature Date. 


10/18/05 
13 : 26 : 22f 


FD-192 


ICMIPR01 
Page 1 


Title and Character of Case: 
SAINT LOUIS POST DISPATCH 


Date Property Acquired: 
10/17/2005 


Source from which Property Acquired: 
CART HQ 


bo 

b7C 


Anticipated Disposition: Acquired Bv: Case Agent : 


Description of Property: Date Entered 

IB 3 

DESL2 - DEHQ3 , ONE (1) CDR W/CART EXAM RESULTS; 

DESL3 - DEHQ2 , ONE (1) HDD, 20GB CAP, W/RESULTS OF CART EXAM 
DESL4 - DEHQ1 , ONE (1) HDD, 250GB CAP., RESTORED IMAGE OF 
TARGET HDD (QHQ1) ; 

DESL5 - QHQ1, ONE (1) HDD, RESTORED FROM TAPE (DESL1) 

Barcode: E02131639 Location: ECR ROW6 CAB 3 10/18/2005 


Case Number: 
Owning Office: 


288A-SL- 190190 
ST LOUIS 






Printed Name: 


.Signature. 


.Date. 


03/08/05 

10:17:05 


FD-192 


ICMIPR01 
Page 1 


Title and Character of Case : 
SAINT LOUIS POST DISPATCH 


Date Property Acquired: 
03/07/2005 


Source from which Property Acquired: 
ORIGINAL EVIDENCE (E01979557) 


Anticipated Disposition: Acquired By: 


Case Agent : 


b6 
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Description of Property: 
IB 2 



Date Entered 


03/08/2005 






Chain of Custody FD-192 
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Printed Name : . ... . ... . . ... . ... . . . ... . .'Signature: 


Reason: 

Printed Name; 


.Date/Time : 
.Signature : 


Reason: 

Printed Name; 


Reason: 

Printed Name; 


Reason: 

Printed Name; 


.Date/Time : 

.Signature : 

.Date/Time : 
. Signature : 

.Date/Time ; 

. Signature ; 


Reason: 

Printed Name ; 


Reason: 

Printed Name ; 


.Date /Time : 
. Signature : 

.Date/Time ; 

.Signature; 


Reason: 

Printed Name; 


Reason: 

Printed Name; 


.Date/Time : 
.Signature: 

.Date/Time ; 

.Signature; 


Reason: 

Printed Name; 


.Date/Time : 
.Signature ; 




Weapons Rendered Safe by: 
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